CVE-2026-64628 describes a stored XSS vulnerability in Grav CMS's shortcode-core attribute handlers. The issue is due to insufficient input neutralization during web page generation, where the XSS detection mechanism only detects payloads containing literal angle brackets. This limitation allows attackers with admin.pages permission to inject malicious JavaScript through shortcode attributes. The injected script executes in the context of any user viewing the affected page, including administrators, enabling session hijacking through theft of admin nonces. The vulnerability has a CVSS 4.0 base score of 5.1 (medium severity). There is no vendor advisory or patch information available at this time.

Successful exploitation allows an attacker with admin.pages permission to inject persistent malicious JavaScript code that executes in the browsers of users viewing the affected pages, including administrators. This can lead to session hijacking by stealing admin nonces, compromising administrative control of the Grav CMS instance. The vulnerability does not require user interaction beyond viewing the affected content and has a network attack vector with low attack complexity and low privileges required (admin.pages permission).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict admin.pages permissions to trusted users only and monitor for suspicious shortcode usage. Avoid using untrusted input in shortcode attributes. Follow vendor updates closely for any forthcoming patches or official mitigations.